Rpcclient

Basic

rpcclient $>
    rpcclient $> srvinfo
    rpcclient $> enumdomusers
    rpcclient $> queryuser <rid>
    rpcclient $> querydominfo
    rpcclient $> getdompwinfo   //password policy
    rpcclient $> netshareenum

ref: rpcclient good help - bitvijays